Denial of service attack analysis method, device, equipment, medium and product

Abstract

The invention discloses a denial of service attack analysis method, device and equipment, a medium and a product. The method comprises the following steps: acquiring a global attack analysis model issued by a central server and denial of service attack data of the central control server; the global attack analysis model is obtained by the hosts and the central server based on a federated learning mode; analyzing the denial of service attack data based on a global attack analysis model to obtain a central control server portrait; and according to the central control server portrait, simulating the zombie host to establish an encrypted communication connection with the central control server, receiving an encrypted denial of service attack instruction of the central control server, and decrypting and analyzing the encrypted denial of service attack instruction to obtain denial of service attack information of the central control server. According to the invention, precious attack information is provided for active defense of the denial of service attack, and the defense efficiency and effectiveness of the denial of service attack are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a denial of service attack analysis method, device, equipment, medium and product. BACKGROUND

[0002] A denial of service attack (DDoS) is a network attack method that paralyzes normal services by maliciously consuming target system resources. Attackers often manipulate a large number of hijacked devices to form a botnet, and use a flood of junk requests to block server channels, or use protocol design flaws to amplify attack traffic. This attack has the characteristics of large attack strength, difficult traceability, high defense cost, and wide chain impact. The traffic peak can collapse the system in a short time, the anonymization technology makes it difficult to locate the attack source, the protection needs to rely on high-cost professional equipment, and the attack may cause a chain paralysis of multiple associated services.

[0003] Current denial of service attack monitoring technologies mainly have two schemes: the first is based on traffic characteristics, and determines the attack by monitoring the changes of the preset traffic threshold (such as bandwidth, number of requests, and number of connections) of the protected object. This scheme is easy to be used by attackers to make the system overload through slow query and other methods. When the traffic reaches the service side application, it causes actual attacks, and the monitoring means is relatively lagging.

[0004] The second is based on botnet monitoring, and deploys a botnet honeypot to perceive the destination of the attack planned by the attacker in advance. This scheme requires a certain amount of advance perception capability, but the number of botnet monitoring is limited, and a large number of organizations need to cooperate to share intelligence. However, virus samples, attack instructions and attack behaviors are sensitive and protective, and it is difficult to cooperate across organizations. SUMMARY

[0005] The present application provides a denial of service attack analysis method, device, equipment, medium and product to solve the problem that the existing denial of service attack monitoring scheme cannot obtain denial of service attack intelligence, resulting in poor and inefficient active defense effect of denial of service attack.

[0006] In a first aspect, an embodiment of the present application provides a denial of service attack analysis method applied to a host in an attack detection system, wherein the attack detection system further includes a central server in communication connection with a plurality of hosts, the host is a denial of service attack object of a central control server, and the host and the central server are in a trusted execution environment; the method comprises:

[0007] obtaining a global attack analysis model issued by a central server and denial of service attack data of a central control server; the global attack analysis model is obtained by each host and the central server based on a federated learning mode;

[0008] analyze the denial-of-service attack data based on the global attack analysis model to obtain a central control server portrait;

[0009] simulate a zombie host to establish an encrypted communication connection with the central control server according to the central control server portrait, receive an encrypted denial-of-service attack instruction of the central control server, and decrypt and analyze the encrypted denial-of-service attack instruction to obtain denial-of-service attack information of the central control server.

[0010] In a second aspect, an embodiment of the present application provides a denial-of-service attack analysis device, comprising:

[0011] The device is applied to a host in an attack detection system, the attack detection system further comprising a central server establishing a communication connection with a plurality of hosts, and the attack detection system being in a trusted execution environment, and the device comprising:

[0012] an obtaining module, configured to obtain a global attack analysis model and denial-of-service attack data of a central control server, wherein the global attack analysis model is obtained by each host and the central server based on a federated learning mode, and the central control server is configured to perform a denial-of-service attack on the host;

[0013] a portrait analysis module, configured to analyze the denial-of-service attack data based on the global attack analysis model to obtain a central control server portrait;

[0014] an attack analysis module, configured to simulate a zombie host to establish an encrypted communication connection with the central control server according to the central control server portrait, receive an encrypted denial-of-service attack instruction of the central control server, and decrypt and analyze the encrypted denial-of-service attack instruction to obtain denial-of-service attack information of the central control server.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, comprising:

[0016] at least one processor;

[0017] and a memory in communication with the at least one processor;

[0018] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the denial-of-service attack analysis method of any embodiment of the present application.

[0019] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores computer instructions for enabling a processor to execute the denial-of-service attack analysis method of any embodiment of the present application when executed.

[0020] In a fifth aspect, an embodiment of the present application provides a computer program product comprising a computer program which, when executed by a processor, implements the denial-of-service attack analysis method according to any of the embodiments of the present application.

[0021] The technical scheme of the embodiment of the present application obtains the global attack analysis model issued by the central server and the denial-of-service attack data of the central control server; the global attack analysis model is obtained by each host and the central server based on a federated learning mode; the denial-of-service attack data is analyzed based on the global attack analysis model to obtain the portrait of the central control server; the encrypted communication connection between the zombie host and the central control server is simulated according to the portrait of the central control server, the encrypted denial-of-service attack instruction of the central control server is received and decrypted and analyzed to obtain the denial-of-service attack information of the central control server. The global attack analysis model trained by the federated learning model determines the portrait of the central control server, which is used to penetrate the anti-detection mechanism of the central control server and receive the instruction, provides valuable attack intelligence for the active defense of the denial-of-service attack, and solves the problem that the existing denial-of-service attack monitoring scheme is difficult to obtain the attack intelligence of the denial-of-service attack, resulting in poor and inefficient active defense effect of the denial-of-service attack, and has the beneficial effect of improving the defense efficiency and effectiveness of the denial-of-service attack.

[0022] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present application, nor is it used to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0024] Figure 1 A flowchart of a denial-of-service attack analysis method provided for the first embodiment of the present application;

[0025] Figure 2 A flowchart of the training step of the global attack analysis model in a denial-of-service attack analysis method provided for the second embodiment of the present application;

[0026] Figure 3 A structural schematic diagram of a denial-of-service attack analysis device provided for the second embodiment of the present application;

[0027] Figure 4A schematic diagram of the structure of an electronic device for implementing the denial-of-service attack analysis method of this invention. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] It should also be noted that the execution entity of the method described in this invention is an authorized network security defense system. All operations are performed within the network environment to which this defense system belongs or is explicitly authorized, aiming to understand its communication mechanism through secure and controllable interactive probing of known malicious central control servers, and then extract feature information for updating defense rules. It is important to clarify that the technical solution of this invention does not involve unauthorized access, tampering, or destruction of any third-party systems or data. Its core innovation lies in a high-fidelity simulated communication and secure parsing mechanism, which strictly adheres to the principle of "receiving but not executing," meaning the simulated host only receives and decrypts the instruction data from the central control server, and never actually executes any attack instructions, thus completely eliminating the possibility of causing damage to any third party at the technical level. The attack information output by this invention (such as target, type, port, etc.) will be used exclusively to enhance network security protection capabilities, for example, to update the interception strategy of next-generation firewalls, or to issue security warnings to potential attack targets.

[0031] Example 1

[0032] Figure 1This is a flowchart of a denial-of-service (DoS) attack analysis method provided in Embodiment 1 of the present invention. This embodiment is applicable to analyzing DoS attacks on a central control server. In this embodiment, the attack detection system includes multiple hosts and a central server. Each host and the central server is in a trusted execution environment, and the hosts can be targets of DoS attacks on the central control server. The method can be executed by a DoS attack analysis device deployed on each host. This DoS attack analysis device can be implemented in hardware and / or software and can be configured in an electronic device.

[0033] like Figure 1 As shown, the method includes:

[0034] S110. Obtain the global attack analysis model and denial-of-service attack data from the central control server; the global attack analysis model is obtained by each host and the central server based on the federated learning model.

[0035] The global attack analysis model can be considered as a denial-of-service attack data used to analyze the central control server. It can be trained by each host and the central server in the attack detection system based on a federated learning model.

[0036] Denial-of-service (DoS) attack data can be considered as data related to DoS attacks initiated by the central control server. In this embodiment, DoS attack data can be real DoS attack data collected from a real-world scenario of a DoS attack initiated by the central control server against a host, or DoS attack data obtained based on simulation and sandbox analysis.

[0037] In this implementation, the central server sends initialization parameters of the initial attack analysis model to the hosts. Each host collects local sample attack data and trains its own initial attack analysis model based on this data, obtaining local attack analysis model parameters and thus protecting the privacy of denial-of-service attack data. The local attack analysis model parameters trained by each host are then uploaded to the central server. The central server aggregates the local attack analysis models after parameter updates, obtaining global model parameters, which are then sent to each host. This allows each host to update its local initial attack analysis model parameters, ultimately obtaining the final global attack analysis model.

[0038] In this embodiment, denial-of-service (DoS) attack data of the central control server can be obtained through the real-time traffic probe of the honeypot's sandbox behavior tracing module and / or intrusion detection module. The integrity of the DoS attack data is verified through a blockchain verification gateway deployed on the threat intelligence platform. For example, DoS attack data may include: polymorphic binary files based on DDoS botnets, encrypted configuration files, and command and control communication data. Polymorphic binary files based on DDoS botnets can be considered as malicious programs with identical functionality but constantly changing byte sequences, designed to evade signature-based antivirus software detection by altering their appearance. Encrypted configuration files can be considered as encrypted instruction sets or data files separate from the botnet's main program, typically containing key parameters required for botnet operation, such as the central control server's IP address or domain name list, attack tasks (attack target, port, and duration), heartbeat intervals, and encryption keys. Control communication data can be considered as all network traffic between the botnet and the central control server, and between the central control server and the attacker's control terminal.

[0039] In this embodiment, the host can also use a threshold signature mechanism to define the data boundaries of the participants (such as security vendors / enterprise nodes), and deploy a lightweight TEE host to realize a local trusted execution environment, ensuring that the training of the global attack analysis model and the analysis of denial-of-service attack data are executed in a secure and trusted environment.

[0040] S120. Analyze denial-of-service attack data based on the global attack analysis model to obtain a profile of the central control server.

[0041] In this context, the central control server profile can be considered as building a comprehensive, multi-dimensional identity and behavioral record for the central control server. This profile enables accurate detection, continuous tracking, and effective countermeasures against specific threats.

[0042] In this embodiment, denial-of-service attack data is input into the attack detection system based on a global attack analysis model trained using a federated learning model. The denial-of-service attack data is then analyzed, and a profile of the central control server is constructed based on the data analysis results.

[0043] S130. Based on the profile of the central control server, simulate a zombie host to establish an encrypted communication connection with the central control server, receive encrypted denial-of-service attack instructions from the central control server, decrypt and analyze the encrypted denial-of-service attack instructions, and obtain denial-of-service attack information from the central control server.

[0044] In this context, a zombie host can be considered a host with malware installed. Denial-of-service attack information can be related to a denial-of-service attack on a central server, such as the attack target (IP address or domain name), attack type, attack port, attack parameters (packet size, sending rate, and duration, etc.), and trigger time (executed immediately or after a specific time and event).

[0045] In this embodiment, after determining the profile of the central control server, the host can simulate a zombie host based on the profile, successfully handshake with the central control server, and be accepted as a trusted "zombie" by the central control server. Specifically, it can initiate a connection using the address (IP / domain name) and port determined in the central control server profile, complete the reversed authentication process, and have the central control server register the zombie host. Following the analyzed patterns, it stably sends heartbeat packets, remains online, and awaits attack commands from the central control server. The host continuously monitors network traffic in the background by simulating a zombie host. Based on protocol characteristics, it identifies and filters encrypted denial-of-service (DoS) attack commands from the data stream, decrypts the DoS attack commands, and then parses the structured DoS attack information according to the reversed command format.

[0046] The technical solution of this invention involves acquiring a global attack analysis model issued by a central server and denial-of-service (DoS) attack data from a central control server. The global attack analysis model is obtained from each host and the central server using a federated learning model. Based on this model, the DoS attack data is analyzed to obtain a profile of the central control server. A botnet host is simulated to establish an encrypted communication connection with the central control server, receiving encrypted DoS attack commands from the central control server and decrypting and analyzing these commands to obtain DoS attack information from the central control server. The global attack analysis model, trained using a federated learning model, determines the profile of the central control server, which is used to deceive the server's anti-detection mechanism to infiltrate and receive commands. This provides valuable attack intelligence for proactive defense against DoS attacks, improving the efficiency and effectiveness of DoS attack defense.

[0047] As an optional embodiment of this example, obtaining denial-of-service attack data from the central control server in S110 includes:

[0048] A1. Obtain multi-source data from the central control server and a denial-of-service attack identification model.

[0049] In this embodiment, the attack identification model is used to identify denial-of-service attack data from multi-source data of the central control server. The multi-source data of the central control server can be obtained through methods such as the sandbox behavior tracing module of the honeypot and / or the real-time traffic probe of the intrusion detection module.

[0050] Attack identification models can be built by multiple independent security domain participants (such as enterprises, cloud service providers, threat intelligence alliances, etc.) based on a secure multi-party computation framework. During the training of the attack identification model, each participant only exchanges the encrypted gradient parameters of their local model, ensuring local data privacy. Furthermore, each participant aligns sample labels by finding the intersection of privacy sets (e.g., botnet family classification) to avoid exposing non-intersection data. Homomorphic hashing is used to perform consistency checks on local feature dimensions, ensuring alignment of the federated model's input space. During the training of the local model, each participant uses their local botnet sample set to train the initial denial-of-service attack identification model and generate gradient tensors. Differential privacy noise (e.g., Gaussian noise) is applied to the gradients to satisfy differential privacy constraints and resist gradient leakage attacks. The initial denial-of-service attack identification model can be a lightweight graph convolutional network (GCN) or a temporal feature extraction model (e.g., Transformer).

[0051] A2. Based on the denial-of-service attack identification model, attack data identification is performed on the multi-source data to obtain the identification result; the multi-source data whose identification result is denial-of-service attack is determined as denial-of-service attack data.

[0052] In this embodiment, the acquired multi-source data is input into the denial-of-service attack identification model to identify denial-of-service attack data from the multi-source data. The denial-of-service attack data is used to construct a profile of the central control server.

[0053] This embodiment identifies the types of multi-source data from the central control server by creating a denial-of-service attack identification model, thereby obtaining denial-of-service attack data and providing effective data support for profiling the central control server.

[0054] As an optional embodiment of this example, after obtaining the denial-of-service attack information from the central control server, the method further includes:

[0055] The denial-of-service attack information is de-identified based on the differential privacy algorithm to obtain de-identified attack information;

[0056] The de-identified attack information is uploaded to a threat intelligence platform in the cloud, so that the threat intelligence platform can generate a defense strategy based on the de-identified attack information and synchronize it to each host in the attack detection system via blockchain.

[0057] Among them, de-identified attack information can be considered as denial-of-service attack information that has been de-identified.

[0058] In this embodiment, the method for desensitizing denial-of-service attack information based on differential privacy algorithms can be to inject noise using a Laplace mechanism for numerical fields, such as port numbers and attack durations, to satisfy differential privacy constraints. The core parameter used to control the protection strength of differential privacy is... It can be dynamically adjusted based on field sensitivity (such as the IP entropy value of the attack target).

[0059] Anonymized attack information is uploaded to a cloud-based threat intelligence platform for use by other defense nodes, preventing attackers from tracing back to the attack analysis system. The threat intelligence platform can dynamically generate defense strategies (such as traffic scrubbing rules) based on the anonymized attack information and synchronize them to all hosts in the attack detection system via blockchain, ensuring the credibility and consistency of the strategies. Attribute-based encryption (ABE) is used to define fine-grained access policies, which are embedded in blockchain smart contracts to achieve automatic permission verification.

[0060] This embodiment combines the fine-grained control of attribute-based encryption, the immutability and distributed nature of blockchain, and the automated execution capabilities of smart contracts to construct a secure, reliable, and automated attack data access control system for storing attack information.

[0061] Example 2

[0062] Figure 2 This is a flowchart illustrating the training steps of the global attack analysis model in a denial-of-service attack analysis method according to Embodiment 2 of the present invention. This embodiment describes the training steps of the global attack analysis model based on the above embodiments. Figure 2 As shown, the method includes:

[0063] S210. Obtain the attack sample set; the attack samples in the attack sample set include at least one sample tuple, and the sample tuple includes the real profile data of the central control server and the sample attack data.

[0064] In one implementation of this embodiment, obtaining the attack sample set includes:

[0065] By using the sandbox behavior tracing module of the honeypot, the real-time traffic probe of the intrusion detection module, and the blockchain deployed on the threat intelligence platform, sample attack data and the real profile data of the corresponding central control server are obtained; wherein, the sample attack data includes at least one of the following: polymorphic binary files based on botnets, encrypted configuration files, and command and control communication data;

[0066] Based on the sample attack data and the corresponding real profile data of the central control server, at least one sample tuple is determined; and the set of all sample tuples is determined as the attack sample set.

[0067] In this embodiment, sample attack data can be obtained in the following ways: (1) Deploy a high-interaction honeypot to simulate a real business system and attract the central control server, which acts as the attacker, to enter; in an isolated sandbox environment, allow the malware (such as Trojans, viruses, ransomware) uploaded by the central control server to run freely and observe all its behaviors; record the attack data of the central control server. (2) Deploy probes at key network nodes to analyze the traffic of the entire network in real time, and use rule bases (such as Snort rules) and anomaly detection algorithms to identify known attack traffic and suspicious behaviors to obtain sample attack data. (3) Deploy a blockchain on the threat intelligence platform to collect attack data from multiple sources. The host can obtain real and tamper-proof attack data from the blockchain.

[0068] S220: Receive the initialization parameters of the initial attack analysis model sent by the central server; wherein, the initial attack analysis model is an analytical model based on a dual-channel bidirectional long short-term memory attention mechanism; the initialization parameters are desensitized by a differential privacy algorithm.

[0069] The initial attack analysis model can be considered as the attack analysis model to be trained. The initialization parameters of the initial attack analysis model are determined by the central server and distributed to the host.

[0070] In this embodiment, the initial attack analysis model is an analytical model based on a dual-channel bidirectional long short-term memory attention mechanism. This mechanism can simultaneously process attack sample data representing behavioral characteristics and attack sample data representing traffic characteristics. Furthermore, the bidirectional processing method considers both previous and subsequent information, enabling a more comprehensive understanding of the context. The attention mechanism allows the model to automatically focus on the most critical and judgmental parts of the input sequence, improving the accuracy of the analysis results.

[0071] In this embodiment, reverse engineering is used to deduce the original sensitive data used during training by the central server from the model parameters. Before distributing the model parameters, precisely mathematically controlled random noise is added. This ensures that the overall analytical performance of the model is not significantly affected, while also preventing the inference of any specific information about individual training samples from the noisy parameters. This allows the central server to share model parameters with the host without compromising its data privacy.

[0072] S230. Perform feature extraction and desensitization processing on the attack sample set to obtain the attack sample feature set.

[0073] In this embodiment, each host extracts features from the acquired attack sample set and then de-identifies the extracted sample features to obtain an attack sample feature set for training the local model. The attack sample feature set can include static and dynamic features. Static features can be considered as features obtained through analysis without running the sample data, such as file structure features, code features, and statistical features. Dynamic features can be considered as features obtained through analysis while running the sample data, such as network behavior features, registry operations, and process behavior. De-identification methods can include, for example, generalized paths and hashed strings. This de-identification process achieves a crucial balance between data utilization and privacy protection, ensuring that the entire system is efficient and intelligent while also meeting data security and compliance requirements.

[0074] In one implementation of this embodiment, the step of performing feature extraction and desensitization processing on the attack sample set to obtain an attack sample feature set includes:

[0075] B1. The attack sample set is deobfuscated using an adversarial obfuscation control flow graph reconstruction technique to obtain the attack sample code feature set.

[0076] The control flow graph can be considered a graph structure representing all possible execution paths of a program, consisting of basic blocks and edges. The attack sample code feature set can be considered a collection of the original code features of the attack sample.

[0077] Specifically, for attack sample sets based on obfuscation and countermeasure techniques, control flow graph reconstruction techniques that counter obfuscation and countermeasure techniques are used to deobfuscate the attack sample sets and recover the original attack sample code feature sets.

[0078] B2. Extract fileless attack memory features from the attack sample set to obtain the attack sample memory feature set.

[0079] Among them, the memory feature set of the attack sample can be considered as the feature set of the attack sample in terms of memory usage.

[0080] Traditional security software focuses on scanning files on the disk, while fileless attacks cleverly circumvent this. The malicious payload is not written directly to the hard drive, but is injected into the system's memory for execution through legitimate channels (such as PowerShell, WMI, macros, and exploits). To address this issue, the core of the memory feature extraction in this embodiment is to execute the attack sample within a honeypot sandbox. When the sandbox detects suspicious behavior, it extracts structured data features from memory that characterize fileless attack behavior.

[0081] B3. Extract traffic features from the attack sample set to obtain the attack sample traffic feature set.

[0082] The attack sample traffic feature set can be considered as the set of features of the network traffic contained in the attack sample. For example, it may include: packet size, packet arrival time interval, duration, traffic volume, rate characteristics, and bidirectional traffic ratio.

[0083] In this embodiment, numerical traffic features that can uniquely characterize the communication pattern, server interaction behavior, and attack intent are extracted from the network traffic (such as PCAP data packet files) contained in the attack sample, thereby forming an attack sample traffic feature set.

[0084] B4. De-identify the attack sample traffic feature set; wherein, the de-identification process includes at least one of the following: de-identifying the prefix of the central server address by retaining hash, using a Gaussian mechanism to obfuscate the heartbeat cycle, and encoding and compressing the domain name features based on a Bloom filter.

[0085] In this embodiment, three types of sensitive information in the traffic characteristics—server address, communication timing pattern, and domain name information—are anonymized to protect privacy while maximizing the data's analytical value.

[0086] Specifically, the steps for performing hash-based de-identification processing on the prefix of the central server address can be as follows: extract the network prefix from a complete IP address, apply a cryptographic hash function (such as SHA-256) to the complete original IP address, combine the "plaintext prefix" and the "hash value of the complete IP" to form a de-identified identifier, hide the specific IP address of the central control server, and at the same time retain its network topology information (such as which ISP or geographical region it belongs to).

[0087] The execution steps of using a Gaussian mechanism to obfuscate the heartbeat cycle can be as follows: calculate the precise time interval between consecutive heartbeat packets from the characteristics of sample traffic, and add noise randomly sampled from a Gaussian distribution to each time interval. The variance of the Gaussian distribution (the noise level) needs to be carefully calibrated to ensure that differential privacy requirements are met. A balance needs to be struck between protection strength and data availability. The added noise must be large enough to prevent the inference of the original value, but not so large as to completely disrupt the statistical regularity of the heartbeat cycle. The goal is to protect the precise time-series pattern of attack traffic (especially the regular heartbeat packets between botnets and control servers) while preserving its approximate periodic statistical characteristics.

[0088] The steps for domain name feature encoding compression based on Bloom filters can be as follows: create a database with length m and all bits initially set to m. The array is used to select k different hash functions. For each domain name that needs to be de-identified, the hash value of the domain name is calculated using each of the k hash functions. Each hash value is then modulo m to obtain k positions in the bit array. The values ​​at these k positions are all set to 1. The resulting bit array, filled with 0s and 1s, is the compressed encoding of the set of all domain names. Based on Bloom filter-based domain name feature encoding, the original domain name list cannot be recovered from the Bloom filter's bit array, thus ensuring privacy and confidentiality, while also compressing the data volume for easier storage and transmission.

[0089] B5. The set of the attack sample code feature set, the attack sample memory feature set, and the attack sample traffic feature set after de-identification is determined as the attack sample feature set.

[0090] S240. Train the local model parameters of the initial attack analysis model based on the attack sample feature set, and upload the local model parameters to the central server so that the central processor can aggregate the local model parameters sent by each host, obtain the global model parameters, and send them to each host.

[0091] In this embodiment, each host uses the processed attack sample feature set to train the local model parameters of the initial attack analysis model issued by the central processing unit, obtaining the local model parameters trained locally on the host, and then uploads the local model parameters to the central server. The central server aggregates the local model parameters uploaded by each host, such as by weighted averaging, to obtain the global model parameters; and sends the encrypted global model parameters to each host.

[0092] S250: Receive global model parameters sent by the central server, and update the model parameters of the initial attack analysis model based on the global model parameters to obtain the global attack analysis model.

[0093] In this embodiment, when each host receives the encrypted global model parameters sent by the central server, it decrypts the encrypted global model parameters and updates the model parameters of its local initial attack analysis model or the global attack analysis model for local use based on the global model parameters.

[0094] The technical solution of this invention involves: acquiring an attack sample set; the attack samples in the attack sample set include at least one sample tuple, which includes the real profile data of the central control server and sample attack data; receiving an initial attack analysis model issued by the central server; wherein the initial attack analysis model is an analytical model based on a dual-channel bidirectional long short-term memory attention mechanism; the initialization parameters of the initial attack analysis model are desensitized by a differential privacy algorithm; performing feature extraction and desensitization on the attack sample set to obtain an attack sample feature set; training local model parameters of the initial attack analysis model based on the attack sample feature set, uploading the local model parameters to the central server so that the central processor can aggregate the local model parameters sent by each host to obtain global model parameters and send them to each host; receiving the global model parameters sent by the central server, and updating the model parameters of the initial attack analysis model based on the global model parameters to obtain a global attack analysis model. The global attack analysis model trained by the federated learning model determines the profile of the central control server, which is used to deceive the anti-detection mechanism of the central control server to infiltrate and receive instructions, providing valuable attack intelligence for proactive defense against denial-of-service attacks, and improving the efficiency and effectiveness of defense against denial-of-service attacks.

[0095] Example 3

[0096] Figure 3 This is a schematic diagram of a denial-of-service attack analysis device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes: an acquisition module 310, a profile analysis module 320, and an attack analysis module 330; wherein,

[0097] The acquisition module 310 is used to acquire the global attack analysis model issued by the central server and the denial-of-service attack data of the central control server; the global attack analysis model is obtained by each of the hosts and the central server based on a federated learning mode; the central control server is used to launch denial-of-service attacks against the hosts;

[0098] The profile analysis module 320 is used to analyze the denial-of-service attack data based on the global attack analysis model to obtain a profile of the central control server.

[0099] The attack analysis module 330 is used to simulate a zombie host based on the profile of the central control server to establish an encrypted communication connection with the central control server, receive denial-of-service attack instructions from the central control server, decrypt and analyze the denial-of-service attack instructions, and obtain denial-of-service attack information from the central control server.

[0100] The technical solution of this invention involves acquiring a global attack analysis model issued by a central server and denial-of-service (DoS) attack data from a central control server. The global attack analysis model is obtained from each host and the central server using a federated learning model. Based on this model, the DoS attack data is analyzed to obtain a profile of the central control server. A botnet host is simulated to establish an encrypted communication connection with the central control server, receiving encrypted DoS attack commands from the central control server and decrypting and analyzing these commands to obtain DoS attack information from the central control server. The global attack analysis model, trained using a federated learning model, determines the profile of the central control server, which is used to deceive the server's anti-detection mechanism to infiltrate and receive commands. This provides valuable attack intelligence for proactive defense against DoS attacks, improving the efficiency and effectiveness of DoS attack defense.

[0101] Optionally, module 310 is used for:

[0102] Acquire multi-source data and denial-of-service attack identification models from the central control server;

[0103] The attack data is identified based on the denial-of-service attack identification model to obtain the identification results;

[0104] The multi-source data identified as a denial-of-service attack is determined to be denial-of-service attack data.

[0105] Optionally, the device further includes:

[0106] The information desensitization module is used to desensitize the denial-of-service attack information based on the differential privacy algorithm after obtaining the denial-of-service attack information from the central control server, so as to obtain desensitized attack information.

[0107] The information reporting module is used to upload the de-identified attack information to the threat intelligence platform in the cloud, so that the threat intelligence platform can generate a defense strategy based on the de-identified attack information and synchronize it to each host in the attack detection system through the blockchain.

[0108] Optionally, the device further includes a model training module, the model training module comprising:

[0109] The sample set acquisition unit is used to acquire an attack sample set; the attack samples in the attack sample set include at least one sample tuple, and the sample tuple includes the real profile data of the central control server and sample attack data;

[0110] The model parameter receiving module is used to receive the initialization parameters of the initial attack analysis model issued by the central server; wherein, the initial attack analysis model is an analytical model based on a dual-channel bidirectional long short-term memory attention mechanism; the initialization parameters are de-identified by a differential privacy algorithm;

[0111] The sample feature extraction unit is used to extract and desensitize the attack sample set to obtain the attack sample feature set.

[0112] The model parameter training unit is used to train local model parameters of the initial attack analysis model based on the attack sample feature set.

[0113] A local model parameter uploading unit is used to upload the local model parameters to the central server, so that the central processing unit can aggregate the local model parameters sent by each host, obtain global model parameters, and send them to each host.

[0114] The model parameter update unit is used to receive global model parameters sent by the central server, and update the model parameters of the initial attack analysis model based on the global model parameters to obtain the global attack analysis model.

[0115] Optionally, the sample set acquisition unit is specifically used for:

[0116] The sample attack data and the corresponding real profile data of the central control server are obtained through the sandbox behavior tracing module of the honeypot, the real-time traffic probe of the intrusion detection module, and the blockchain verification gateway deployed on the threat intelligence platform; wherein, the sample attack data includes at least one of the following: polymorphic binary files based on botnets, encrypted configuration files, and command and control communication data.

[0117] Based on the sample attack data and the corresponding real profile data of the central control server, at least one sample tuple is determined; and the set of all sample tuples is determined as the attack sample set.

[0118] Optionally, the sample feature extraction unit is specifically used for:

[0119] The attack sample set is deobfuscated using an adversarial obfuscation control flow graph reconstruction technique to obtain an attack sample code feature set.

[0120] Fileless attack memory feature extraction is performed on the attack sample set to obtain the attack sample memory feature set;

[0121] Traffic features are extracted from the attack sample set to obtain the attack sample traffic feature set;

[0122] The attack sample traffic feature set is anonymized; wherein the anonymization process includes at least one of the following: hash-preserving anonymization of the prefix of the central server address, using a Gaussian mechanism to obfuscate the heartbeat cycle, and encoding and compressing the domain name features based on a Bloom filter;

[0123] The set of attack sample code features, attack sample memory features, and de-identified attack sample traffic features is defined as the attack sample feature set.

[0124] The denial-of-service attack analysis device provided in this embodiment of the invention can execute the denial-of-service attack analysis method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0125] Example 4

[0126] Figure 4 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0127] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0128] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0129] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as denial-of-service attack analysis methods.

[0130] In some embodiments, the denial-of-service attack analysis method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the denial-of-service attack analysis method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the denial-of-service attack analysis method by any other suitable means (e.g., by means of firmware).

[0131] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0132] In some embodiments, the denial-of-service attack analysis method may be implemented as a computer program, which is implicitly included in a computer program product. When executed by a processor, the computer program implements the denial-of-service attack analysis method of the present invention. The computer program product can be understood as a software product that primarily implements its solution through a computer program. The computer program used to implement the method of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer program causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer program may be executed entirely on a machine, partially on a machine, partially on a remote machine as a standalone software package, or entirely on a remote machine or server.

[0133] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0134] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0135] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0136] A computing system can include hosts and servers. Hosts and servers are generally located far apart and typically interact through communication networks. The host-server relationship is established by computer programs running on the respective computers and having a host-server relationship with each other. A server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0137] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0138] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for analyzing denial-of-service attacks, characterized in that, The method involves using a host in an attack detection system, wherein the attack detection system further includes a central server that establishes communication connections with multiple hosts, the hosts being targets of denial-of-service attacks by the central server, and the hosts and the central server being in a trusted execution environment; the method includes: The system obtains the global attack analysis model issued by the central server and the denial-of-service attack data from the central control server; the global attack analysis model is obtained by each host and the central server based on a federated learning model. The denial-of-service attack data is analyzed based on the global attack analysis model to obtain a profile of the central control server; Based on the profile of the central control server, a simulated zombie host establishes an encrypted communication connection with the central control server, receives encrypted denial-of-service attack instructions from the central control server, decrypts and analyzes the encrypted denial-of-service attack instructions, and obtains denial-of-service attack information from the central control server.

2. The method according to claim 1, characterized in that, Data obtained from denial-of-service attacks on the central control server includes: Acquire multi-source data and denial-of-service attack identification models from the central control server; The attack data is identified based on the denial-of-service attack identification model to obtain the identification results; The multi-source data identified as a denial-of-service attack is determined to be denial-of-service attack data.

3. The method according to claim 1, characterized in that, After obtaining denial-of-service attack information from the central control server, the process also includes: The denial-of-service attack information is de-identified based on the differential privacy algorithm to obtain de-identified attack information; The de-identified attack information is uploaded to a threat intelligence platform in the cloud, so that the threat intelligence platform can generate a defense strategy based on the de-identified attack information and synchronize it to each host in the attack detection system via blockchain.

4. The method according to claim 1, characterized in that, The training steps of the global attack analysis model include: Obtain an attack sample set; the attack samples in the attack sample set include at least one sample tuple, and the sample tuple includes the real profile data of the central control server and sample attack data; The system receives initialization parameters for the initial attack analysis model from the central server; wherein the initial attack analysis model is an analytical model based on a dual-channel bidirectional long short-term memory attention mechanism; and the initialization parameters are anonymized using a differential privacy algorithm. The attack sample set is subjected to feature extraction and desensitization processing to obtain the attack sample feature set; Local model parameters of the initial attack analysis model are trained based on the attack sample feature set; The local model parameters are uploaded to the central server so that the central processing unit can aggregate the local model parameters sent by each host to obtain global model parameters and send them to each host. Receive global model parameters sent by the central server, and update the model parameters of the initial attack analysis model based on the global model parameters to obtain the global attack analysis model.

5. The method according to claim 4, characterized in that, The acquired attack sample set includes: The sample attack data and the corresponding real profile data of the central control server are obtained through the sandbox behavior tracing module of the honeypot, the real-time traffic probe of the intrusion detection module, and the blockchain verification gateway deployed on the threat intelligence platform; wherein, the sample attack data includes at least one of the following: polymorphic binary files based on botnets, encrypted configuration files, and command and control communication data. Based on the sample attack data and the corresponding real profile data of the central control server, at least one sample tuple is determined; and the set of all sample tuples is determined as the attack sample set.

6. The method according to claim 4, characterized in that, The step of performing feature extraction and desensitization processing on the attack sample set to obtain the attack sample feature set includes: The attack sample set is deobfuscated using an adversarial obfuscation control flow graph reconstruction technique to obtain an attack sample code feature set. Fileless attack memory feature extraction is performed on the attack sample set to obtain the attack sample memory feature set; Traffic features are extracted from the attack sample set to obtain the attack sample traffic feature set; The attack sample traffic feature set is anonymized; wherein the anonymization process includes at least one of the following: hash-preserving anonymization of the prefix of the central server address, using a Gaussian mechanism to obfuscate the heartbeat cycle, and encoding and compressing the domain name features based on a Bloom filter; The set of attack sample code features, attack sample memory features, and de-identified attack sample traffic features is defined as the attack sample feature set.

7. An attack analysis device, characterized in that, A host used in an attack detection system, the attack detection system further including a central server that establishes communication connections with multiple hosts, the attack detection system being in a trusted execution environment, the apparatus comprising: The acquisition module is used to acquire the global attack analysis model issued by the central server and the denial-of-service attack data of the central control server; the global attack analysis model is obtained by each of the hosts and the central server based on a federated learning model; the central control server is used to launch denial-of-service attacks against the hosts. The profile analysis module is used to analyze the denial-of-service attack data based on the global attack analysis model to obtain a profile of the central control server. The attack analysis module is used to simulate a zombie host based on the profile of the central control server and establish an encrypted communication connection with the central control server, receive denial-of-service attack instructions from the central control server, decrypt and analyze the denial-of-service attack instructions, and obtain denial-of-service attack information from the central control server.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to perform the attack analysis method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the attack analysis method according to any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the attack analysis method according to any one of claims 1-6.

Images